Custom Post Type UI, CVE-2025-12826

CVE, Research URL: CVE-2025-12826
Home page URL: Security reports for Custom Post Type UI
Application: Custom Post Type UI
Published on: Dec 04, 2025
Research Description: The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0. This is due to the plugin not verifying that a user has the required capability to perform actions in the "cptui_process_post_type" function. This makes it possible for authenticated attackers, with subscriber level access and above, to add, edit, or delete custom post types in limited situations.
Affected versions: max 1.18.1.
Status: vulnerable